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We investigate the security bounds of quantum cryptographic protocols using d-level systems. In 
particular, we focus on schemes that use two mutually unbiased bases, thus extending the BB84 
quantum key distribution scheme to higher dimensions. Under the assumption of general coherent 
attacks, we derive an analytic expression for the ultimate upper security bound of such quantum 
cryptography schemes. This bound is well below the predictions of optimal cloning machines. The 
possibility of extraction of a secret key beyond entanglement distillation is discussed. In the case 
of qutrits we argue that any eavesdropping strategy is equivalent to a symmetric one. For higher 
dimensions such an equivalence is generally no longer valid. 
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I. INTRODUCTION 

During the last two decades, several quantum key dis- 
tribution (QKD) protocols have been proposed, which 
use two-level quantum systems (qubits) as information 
carriers 0, 0, . The security of these protocols against 
all kinds of attacks has been analyzed extensively and 
various unconditional security proofs have been presented 
0, IH, B 0> @> 0> IHJ • From the experimental point of view, 
a number of prototypes based on qubits have been devel- 
oped while QKD has been successfully performed 
outside the laboratory at distances up to about 67km us- 
ing telecom fibers 0,^3; an d U P to 23.4km 0] through 
open air. 

In contrast to qubits, the use of high-dimensional 
quantum systems in quantum cryptography has at- 
tracted considerable attention only recently. Currently, 
qudits (d-dimcnsional quantum systems) can be real- 
ized experimentally in several ways (including multi- 
port beam splitters, bi-photons, higher-order paramet- 
ric down-conversion and energy-time entanglement) 0, 
0,0]. As far as QKD protocols are concerned, qudits 
can carry more information than qubits increasing thus 
the flux of information between the two legitimate users 
(Alice and Bob). For a prime power d it has been demon- 
strated that there exist [d + 1) mutually unbiased bases. 
Hence, the natural extensions of the standard BB84 and 
six-state qubit-based QKD protocols to higher dimen- 
sions involve 2d and d(d+ 1) states, respectively |l8lll9j. 
These latter qudit-based QKD schemes are able to toler- 
ate higher error rates than their qubit-based counterparts 

no, iin m, ee m 

The maximal error rate that can be tolerated by a par- 
ticular QKD protocol (also referred to as threshold distur- 
bance) quantifies the robustness of the protocol against 
a specific eavesdropping strategy, and depends on the al- 
gorithm that Alice and Bob are using for post-processing 
their raw key. In practice, nowadays secret keys can be 
distilled efficiently by means of one- or even two-way clas- 
sical post-processing [2(||27j, while advantage distillation 
protocols using two-way classical communication seem to 
be still rather inefficient |28| . In principle, however, quan- 



tum distillation protocols involving two-way communica- 
tion between Alice and Bob [also referred to as two-way 
entanglement purification protocols (EPPs)] can tolerate 
substantially higher error rates than their classical coun- 
terparts and can be applied whenever the quantum state 
shared between the two honest parties is freely entangled, 
i.e. distillable 

For 2(g) 2 quantum systems, non-distillability is equiva- 
lent to separability |33l |34| and thus there seems to exist 
a complete equivalence between entanglement distillation 
and secrecy. In particular, for qubit-based QKD proto- 
cols and under the assumption of individual attacks, it 
was proven recently that the extraction of a secret key 
from a quantum state is possible if and only if entan- 
glement distillation is possible |3o|. For higher dimen- 
sions, however, the complete equivalence between entan- 
glement distillation and secrecy, has been put into ques- 
tion by Horodecki et al. [3(|, who showed that a secret 
key can, in principle, be extracted even from bound en- 
tangled states |32j. Nevertheless, for arbitrary dimen- 
sions, provable quantum entanglement is always a nec- 
essary precondition for secure QKD pjsl ]. Therefore, the 
natural question arises whether qudit-based QKD proto- 
cols can indeed go beyond entanglement distillation. In 
other words, what is the maximal error rate that can, in 
principle, be tolerated by a qudit-based QKD under the 
assumption of general coherent attacks ? 

In this paper, we address this question by focus- 
ing on qudit-based QKD protocols that use two mutu- 
ally unbiased bases. Up to date, all investigations re- 
lated to the security of such protocols have concentrated 
mainly on individual attacks (e.g. quantum cloning ma- 
chines) and /or one-way post-processing of the raw key 
[H H HI (H |25|. Here, under the assumption of gen- 
eral coherent (joint) attacks, we show that for estimated 
disturbances below (d—\)/2d Alice and Bob can be con- 
fident that they share distillable entanglement with high 
probability. On the other hand, an estimated disturbance 
above (d — I)/ 2d does not enable Alice and Bob to in- 
fer that their quantum state is entangled (no provable 
quantum entanglement). Hence, in view of the necessary 
precondition for secure key distribution j3Ej, our result 
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demonstrates that (d— l)/2d is also the ultimate thresh- 
old disturbance for the prepare-and-measure schemes of 
the protocols. Furthermore, our result implies that, for 
the post-processing we consider throughout this work, 
the extraction of a secret key beyond entanglement dis- 
tillation is impossible in the framework of qudit-based 
QKD protocols using two bases. 

This paper is organized as follows : For the sake of 
completeness, in Sec. [H]we summarize basic facts which 
are necessary for the subsequent discussion. In Sec. 
IIIII we briefly describe the prepare-and-measure and the 
entanglement-based versions of the 2-bases QKD proto- 
cols using qudits. Subsequently, Sec. IIVI focuses on the 
key quantity of this work namely, the estimated error rate 
(disturbance) and its symmetries. Finally, the threshold 
disturbance for 2-bases qudit-based QKD protocols, is 
derived in Sec. 0and various examples are presented. 



II. QUDITS AND THE GENERALIZED PAULI 
GROUP 

Throughout this work we consider QKD protocols with 
qudit systems as information carriers. Each qudit cor- 
responds to a d— dimensional Hilbert space C d where 
d = z£is a prime power, i.e. p is a prime and r is an inte- 
ger |39j. From now on all the arithmetics are performed 
in the finite (Galois) field F d |4C|. 

Theoretical investigations of d-level quantum systems 
are performed conveniently with the help of the gener- 
alized Pauli group. For this purpose let us define the 
unitary operators 



with 



Z = 5> te W|a><a|, 

aGF d 



(1) 

(2) 



where u> = exp(z2-7r/p) is a primitive p-th root of unity 
and 



r-i 

tr(a) = ^ 

3=0 



(3) 



is the absolute trace of a £ Fj. The states { |a); a e F^} 
constitute an orthonormal computational basis on the 
Hilbert space of a qudit C d . The unitary operators X 
and Z generate the generalized Pauli group with unitary 
elements 

£ mn ={X m Z n :m,neF d }. (4) 

These d 2 unitary operators form an error group on C d 
|4lj . and are the generalizations of the Pauli operators 
for qubits. In fact the indices m and n refer to shift 
and phase errors in the computational basis, respectively. 
Thus the generalized Pauli operators can be represented 
in the form 



f 
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w tr(fc.n) \k + m )(k\ 



(5) 



(6) 



Consider now a bipartite system of two qudits A and 
B. It is not hard to show that the operators Xa <8 X g 
and Za ® Z B constitute a complete set of commuting op- 
erators in the Hilbert space of two distinguishable qudits 
(g> C B , while their simultaneous eigenstates are the d 2 
maximally entangled states 
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with TO,n € Fd- These states are the generalization of 
the Bell states to higher dimensions and they form an or- 
thonormal basis in C A (g)C B . The singlet state l^oo) is of 
particular interest because it remains invariant under any 
unitary transformation of the form Ua®U b . In fact | S&oo) 
is one of the key elements of the entanglement-based ver- 
sion of the qudit cryptographic protocols described in the 
following section. 



III. TWO-BASES QKD PROTOCOLS 

A. Mutually unbiased bases 

Of central importance in the context of QKD is the no- 
tion of mutually unbiased (maximally conjugated) bases. 
It has been demonstrated that for a prime power d, there 
exist d + 1 such bases, i.e. the eigenbases of the opera- 



tors Z, X, XZ, XZ 2 , . . .,XZ d ~ l [181 [19|. In a qudit- 
based 2-bases QKD protocol (to be referred to hereafter 
as 2d-state protocol), Alice and Bob use for their pur- 
poses only two mutually unbiased bases B\ and Bi with 
d basis-states each. Following H3 > from now on the 
eigenbasis { \k) : k £ F d } of the operator Z is chosen as 
the standard (computational) basis B\ , while the second 
basis 2?2 = { \l) : I € F^} is chosen as the Fourier-dual of 
the computational basis, i.e. \l) = J^ fc Hik \k), with 



n 



Vd . 



i,3& d 



, tr (»\7') 



(8) 



denoting the discrete Fourier transformation. One can 
verify easily that Tt is symmetric and thus unitary, i.e. 

= Ti^ 1 = TL* . This property will be used exten- 
sively in the following sections. Besides, errors in the two 
maximally conjugated bases are related via the discrete 
Fourier transform, i.e. 



(9) 



In other words, shift errors in the computational basis be- 
come phase errors in the complementary basis and vice- 
versa. 
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B. Prepare-and-measure QKD scheme 

In a typical 2d-state prepare-and-measure scheme Al- 
ice sends to Bob a sequence of qudits each of which is 
randomly prepared in one of the 2d non-orthogonal basis- 
states { |fc)} or { \l}}. Bob measures each received parti- 
cle randomly in 8\ or 82- After the distribution stage, 
Alice and Bob agree on a random permutation of their 
data and publicly discuss the bases chosen, discarding all 
the dits where they have selected different bases (sifting 
procedure). Subsequently, they randomly select a suf- 
ficient number of dits |42j from the remaining random 
sifted key and determine their error probability. If, as 
a result of a noisy quantum channel or of an eavesdrop- 
per, the estimated disturbance is too high the protocol 
is aborted. Otherwise, Alice and Bob perform error cor- 
rection and privacy amplification with one- or two-way 
classical communication, in order to obtain a smaller 
number of secret and perfectly correlated random dits 
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C. Entanglement-based QKD scheme 

From the point of view of an arbitrarily powerful eaves- 
dropper the above prepare-and-measure scheme i s eq uiv- 
alent to an entanglement-based QKD protocol |2fl EEL 
43]. In this latter form of the protocol Alice prepares 
each of 27V entangled-qudit pairs in the maximally en- 
tangled state 



l*oo) = 



1 

Vd 



(10) 
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where the subscripts A, B refer to Alice and Bob, re- 
spectively. Alice uses for her purposes the set of bases 
{81,82} whereas Bob uses the set {81,82}, where 82 = 
{H*\k) :ke¥ d } UlEl- 

More precisely, Alice keeps half of each pair and sub- 
mits the other half to Bob after having applied a random 
unitary transformation chosen from the set {l,7i}. As 
soon as Bob acknowledges the reception of all the par- 
ticles, Alice reveals the sequence of operations she per- 
formed on the transmitted qudits and Bob undoes all 
of them, i.e. he applies 1 or JiT 1 on each qudit sepa- 
rately. Thus, at this point, in an ideal system Alice and 
Bob would share 2N qudit-pairs in the state \^m)® 2N ■ 
However, in real systems, due to noise and/or eavesdrop- 
ping all the 2N entangled-qudit pairs will be corrupted. 



In order to ensure secret key distribution Alice and Bob 
permute randomly all the pairs before doing any other 
operations [lOj . In this way, any influence of the eaves- 
dropper (from now on we assume that all the noise in the 
channel is due to eavesdropping) is equally distributed 
among all the pairs. 

The next step of the protocol now involves a verifi- 
cation test which will determine whether the protocol 
should be aborted or not. More precisely, Alice and Bob 
randomly select a number of pairs (say N c ) 0] as check 
pairs and measure each one of them separately along the 
standard (computational) basis. They compare their re- 
sults publicly thus estimating the average error rate dur- 
ing the transmission. After the verification test all the 
check pairs are dismissed and, if the estimated error rate 
is too high the protocol is aborted. Otherwise, Alice and 
Bob apply an appropriate EPP with classical one- or two- 
way communication [23, 12^. I30I I3TL l32] | on the remaining 
2N — N c pairs, in order to distill a smaller number of 
almost pure entangled-qudit pairs. Finally, measuring 
these almost perfectly entangled qudit pairs in a com- 
mon basis, Alice and Bob obtain a secret random key, 
about which an adversary has negligible information. In 
our subsequent treatment we focus on the entanglement- 
based version of the 2d-state QKD protocol. 



IV. ESTIMATED DISTURBANCE AND 
SYMMETRIES 

The verification test performed by Alice and Bob im- 
mediately after the transmission stage is perhaps the 
most crucial stage of the 2-bases QKD protocol and its 
success relies on the "commuting-observables" idea 
More precisely, the fact that all the operations performed 
in a typical EPP commute with a Bell measurement al- 
lows one to reduce any quantum eavesdropping attack to 
a classical probabilistic cheating strategy jj, 0, El E3] • 

During the verification test Alice and Bob focus on 
the parity of their outcomes. Moreover, note that for 
the check pairs where Alice and Bob have performed 7i 
and H^ 1 respectively, the measurements are effectively 
performed in the complementary 82 basis rather than the 
standard basis 8\ @. Thus, given the unitarity of Ti and 
the invariance of l^oo) under any unitary transformation 
of the form Ua <8> U% , the average estimated disturbance 
(error rate) is given by 



1 



2N C ^ ^ ' 

c 6=0,1 ji=i 



(n b 2 ® H b B \ v (n b A ® < 



Pab 



(11) 



where pab denotes the reduced density operator of Alice and Bob for all 2N pairs. The index ji indicates that the 
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corresponding physical observable refers to the ji-th ran- 
domly selected qudit-pair. In particular, the projection 
operator entering Eq. Ijlljl is given by 



V i* = E E \lA,(l + k) B )(l A) (l + k)i 



(12) 



iew d feeF* 



where ¥*, denotes the set of all nonzero elements in the 
field Fd [44J- In other words, the inner summation in 112|) 
is performed over all the nonzero elements of the finite 
field Fd, such that (l + k)s ^ I a- Moreover, the powers of 
the discrete Fourier transformation Tt b , with b € {0, 1}, 
in Eq. I|ll|) reflect the fact that the errors in the sifted 
key originate from measurements in both complementary 
bases which have been selected randomly by Alice and 
Bob with equal probabilities. One can easily verify that 
all the measurements performed during the verification 
test are equivalent to Bell measurements. Indeed, using 
the definition of the Bell states Q the projector Vj i can 
be written in the form 



>* = Ed 



0771,0 ) | ^ 77171 ■I 



(13) 



where 6 m fi is the Kronecker delta [44J- This last relation 
indicates that the verification test performed by Alice 
and Bob is nothing else than a quality-check test of the 
fidelity of the 2N pairs with respect to the ideal state 
\ 1 &oo}® 2N ■ Hence, classical sampling theory can be ap- 
plied for the estimation of the average error rate and the 
establishment of confidence levels Q, [HJ H3 ■ 

We can simplify further our discussion by taking into 
account the symmetry of the QKD protocol under any 
permutation of the pairs. As we discussed earlier, a 



random permutation of all the pairs at the beginning 
of the entanglement-based protocols ensures a homoge- 
neous distribution of the errors introduced by a poten- 
tial eavesdropper (Eve) over all the qudit pairs 0] . This 
is equivalent to saying that the eavesdropping attack is 
symmetric on all the pairs, and such a symmetrization 
argument is one of the key elements of various uncondi- 
tional security proofs 0, 0, OH l20| • Indeed, Eve does not 
know in advance which of the qudit-pairs will be used for 
quality checks and which qudit-pairs will contribute to 
the final key. Hence, she is not able to treat them differ- 
ently and the check pairs constitute a classical random 
sample of all the pairs. 

Invariance of the eavesdropping attack under any per- 
mutation of the pairs implies that all the reduced density 
operators describing the state of each pair shared between 
Alice and Bob are equal, i.e. 



Pab 



(2) 

Pab 



(2N) 

Pab i 



(14) 



where the reduced density operator of Alice's and Bob' 
s fc-th pair is denoted by p^ B = Tt^ b (pab), with Tr^ 
indicating the tracing (averaging) procedure over all the 
qudit-pairs except the fc-th one. It should be stressed 
that Eq. I|14f) does not at all imply that the overall re- 
duced density operator pab of the 2N pairs itself, is a 
product state of all the reduced pair states p^ B . On the 
contrary, pab is expected to have a complicated struc- 
ture as it includes all the effects arising from a general 
coherent (joint) attack of a possible eavesdropper. 

In view of Eq. I|14|l . the average disturbance defined in 
Eqs. I|ll|) is determined by the average error probability 
of an arbitrary qudit pair, say the pair j\, i.e. 



J 



D = 



E T ^:i{[( 

n i v 



fc=0,l 



hi 



(15) 
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where Tr^ 1 ^ denotes the tracing procedure over the ji-th 

qudit pair of Alice and Bob. In other words, the reduced 
(ji) 

single-pair state p^ B contains all the information about 
the noisy quantum channel and a possible general coher- 
ent attack by an eavesdropper, which is relevant for the 
evaluation of the error rate. In particular, this implies 
that an arbitrary joint eavesdropping attack which gives 
rise to a particular state pab obeying Eq. I|14|) is in- 
distinguishable, from the point of view of the estimated 
disturbance, from a corresponding collective attack which 
addresses each qudit individually and results in the 2N- 
pair state of the form Pab> f° r example. 



According to Eqs. I|12fl and l|15(l the average estimated 
disturbance is invariant under the transformations 



(l,b) 
(1,6) 



(l + m,b), 
(l,b® 1), 



(16a) 
(16b) 



with m € Fd, while © denotes addition modulo 2. This 
invariance implies that there are various reduced density 
operators of the ji-th qudit pair, which all give rise to the 
same observed value of the average disturbance. This can 
be seen from Eq. @ which implies elementary relations 
of the form 
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£ mn n h {H b f£l n = H b \j +bn+(l- b)m)(j + bn+(l- b)m\ H b l 



Together with the invariance of D under the transfor- 
mations (|16fl . these elementary relations imply that the 
reduced operators p AB and the symmetrized state 

Pab = E U(h)U(g)p^U( 9 yU(h)\l8) 

give rise to the same value of D. Thereby, the unitary 
operators 

U(g mn ) = £rnn;A ® £*nn;Bi ( 19 ) 

U{hi) = t A ® 1 B , U(h 3 ) = (Ha® H* b ) 2 , 
U(h 2 ) = Ha®H* b , U(h 4 ) = (H A ®H B f, (20) 

have been introduced, which form unitary representa- 
tions of two discrete Abelian groups Q\ = {goo,goi, ■ ■ .} 
and Q2 = {hi,h2,h^,h^\. The key point is now that, 

(71) 

invariance of p^ B under both of these groups is induced 
by the symmetry transformations Ijltil) which leave D in- 
variant. 

V. ENTANGLEMENT DISTILLATION AND 
SECRET KEY 

Having exploited the symmetries underlying the esti- 
mated disturbance, in this section we estimate the thresh- 
old disturbance that can, in principle, be tolerated by any 
2d-state QKD protocol, under the assumption of arbi- 
trary coherent (joint) attacks. To this end, we make use 
of the necessary ■precondition for secret key distillation 
that is, the correlations established between Alice and 
Bob during the state distribution cannot be explained 
by a separable state [slj ]. 

Throughout this work, we consider that Alice and Bob 
focus on the sifted key during the post processing (i.e., 
they discard immediately all the polarization data for 
which they have used different bases) and that they treat 
each pair independently. Thus, according to the afore- 
mentioned precondition, given a particular value of the 
estimated disturbance D, the task of Alice and Bob is to 
infer whether their correlations may have originated from 
a separable state or not. So, our aim is to estimate the 
threshold disturbance D t h such that for any D < D t h -Al- 
ice and Bob share provable entanglement with certainty. 
To this end, we proceed as follows : Firstly, we estimate 
the regime of disturbances for which Alice and Bob share 
distillable entanglement. Secondly, we demonstrate that 
for the remaining regime of disturbances the correlations 
shared between Alice and Bob can always be described 
by a separable state. 



(17) 

I 

A. Threshold disturbance 

Adopting the entanglement-based version of the pro- 
tocol defined in Sec. IHI CI let us estimate the regime of 
disturbances for which Alice and Bob share free entan- 
glement. From the symmetries underlying the observed 
average error rate and in particular from Eq. 1(18(1 we 

have that the density operator p^ B is freely entangled if 

p^ B is freely entangled, as both states are related by lo- 
cal unitary operations and convex summation. Hence, to 
determine the values of the disturbance for which the real 
state pj[ B is distillable, it suffices to determine the distur- 
bances for which the most general two-qubit state pjfg 
(which is invariant under the discrete Abelian groups Q\ 
and Q 2 ) is distillable. 

We already know that the operators U(gio) = Xa®X b 
and U (ffoi) = ® Z* B of the group Gi constitute a com- 
plete set of commuting operators in C A (g> C B , while their 
simultaneous eigenstates are the d 2 maximally entangled 
states defined in Eq. Q. Thus, the most general two- 
qudit state which is invariant under the Abelian group 
Qi is given, by a convex sum of all \^ m n), he. 

PAB= E X mn\^ m n)(^ mn \, (21) 

where the non-negative parameters A mn have to fulfill 
the normalization condition 

E A mn = l. (22) 

Moreover, the operations Ha <S> H b , (Ha <8 H* B ) 2 and 
(Ha ^H^Y transform Bell states into other Bell states. 
Thus, additional invariance of the quantum state H21|) 
under the discrete group Q2 implies that 

As a consequence of Eq. (|23f) there are different sets 
of identical parameters A m „. Each set j contains four 
members r/j unless the chain 123(1 is truncated. The latter 
case occurs for d — m = m and d — n = n, i.e. for 
m,n S {0,d/2}. More precisely, the sets j with m = n G 
{0, d/2} contain one eigenvalue £j each, whereas the set 
with m 7^ n G {0, d/2} has two equal eigenvalues denoted 
by From now on we distinguish between even and odd 
dimensions d. All the sets for both cases as well as their 
notation are summarized in Table [I] 

Given the various sets of eigenvalues, the normalization 
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TABLE I: The notation of the sets and the number of eigen- 
values per set for even and odd dimensions. 



members per set 




number of sets 


notation 




Even d 


Odd d 








2 


1 




2 




1 





c 


A 

4 


(d 2 


-4)/4 


I rl 2 1 ^ 1 A 




condition (|zz|) now 


reads 
















Oddd : 






= 1, 














Even d : 




f 6 + 2C - 


^ 4 E ? fe = 


= 1, 













where in both cases the index j runs over all the possible 
4-member groups i.e., T] odd = (d 2 -l)/4 and r\ even = (d 2 - 
4)/4 (see Table ID. Similarly, using Eqs. (|13[l . I|15|l and 
(|21[) . the estimated average disturbance can be expressed 
in the form 

L<i/2J Va dd 

Odd d : D = 2 J2 7 h + 4 E 

J=l J=|d/2J+1 

rf/2-l r; c „ e „ 

Even d : D = (il( + 2 ^ ,,14 ^ ,„ 

with [x\ denoting the largest integer not greater than x, 
while all the parameters (disturbance and eigenvalues) 
are real- valued and non-negative, i.e. 

o< A&,C,%<1- 

Let us evaluate now the disturbances for which the 
state is distillable. According to the reduction cri- 
terion [33, if p^g is separable, then 



Pa 



U - ~ P { ii > 



(26) 



(and also t A <g> p^ 1J - > 0), with = Tr B [p^ 



as J 



Using the explicit form of pr£g given by Eq. (|21l) we have 

Pa ~ Pb — ^d/d, where t d denotes the unit operator 
in C^L B N. Thus inequality l|26|l reads 



E 



I >o. 



(27) 



Violation of the above inequality l|27l) for any of the eigen- 
values X mn , i.e. 



(28) 



is sufficient for distillability of the entanglement of pj^g 
and implies violation of the Peres criterion (i.e ., a non- 
positive partial transpose) for this state jU H3 • In par- 
ticular, as long as the fidelity / of p^s with respect to 
l^oo) satisfies 



/ = (*oo|^bI*oo) > ~ 



1 



(29) 



the state can be distilled with the help of unitary twirling 
operations Ua ® U B which leave / invariant • ln our 
case, using Eqs. I|21|) and (12.'>fl the distillability condition 
({29")l reads £0 > 1/d or equivalently 



Odd d : D <D + 2 ^ % , 

j=|d/2j+l 

Even d : L» < D + -Ci + 2 E ^> 



j=d/2 



where 



2d 



(31) 



According to these last inequalities, and given the fact 
that £j,CiVj > 0j the threshold disturbance D t h for en- 
tanglement distillation at any dimension satisfies the in- 
equality 



Ah > D , 



(32) 



with D given by l|31|) . For any 13 < D t h, the sym- 
metrized state p^B is always distillable (i.e., freely en- 
tangled). Given that p^g and pj^ are related via local 
operarations and convex summation, the original state 
Pab mu st also be distillable in the same regime of dis- 
turbances. 

Nevertheless, the fact that inequality l|29l) is not sat- 
isfied for D > D t h, does not necessarily imply that the 
state p^B is not at all distillable for D > _D t h- For in- 
stance, there might exist another eigenvalue X mn (and 
not £0) which satisfies inequality i|28|) [i.e., it violates in- 
equality J2HJ)] and this fact, according to the the reduc- 
tion criterion, is also sufficient for distillability of p^ B 
[3^|. Hence, we must now evaluate the precise value of 
the threshold disturbance £> t h- 

One way to prove that strict equality holds in Eq. 132|) 
for any 2d-state QKD protocol is to demonstrate that for 
D > Dq, there always exist separable states which can 
describe Alice's and Bob's correlations and simultane- 
ously are indistinguishable from the real bipartite state 
Pab - To this end, let us focus on bipartite Bell-diagonal 
states i.e., states which can be written in the form i|21|) 
and consider the following particularly simple family of 
such separable states 
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vab(D) = yl d 2 + d\x - y\ 



E 

fceF d 



\k A ){kA\)®(\k B ){ki 



+ d\x-y\ ^2 



(33) 



Thereby 



and 



l + d(d-2)(l-J>) 
d 2 (d-l) ' 
l + d(-l + 2£>) 
d 2 (d- 1) ' 



\kc)({k + i) c \ 

ke¥ d 



while 1^2 denotes the unit operator in C A (S> C^. 

This family is parametrized by the estimated average 
disturbance D detected by Alice and Bob and is valid for 



1 



2d 



-Do < D < 



2d -I 



2d 



(34) 



Moreover, any separable state which belongs to this fam- 
ily is indistinguishable, from the point of view of the es- 
timated error rate, from the real state shared between 
Alice and Bob. In other words, whenever the detected 
disturbance D is within the interval (|34|) , the correlations 
shared between Alice and Bob can be very well described 
in the framework of the family of seprable states gab (D). 
In such a case, the necessary precondition for secret key 
distillation is not met for disturbances within this regime, 
so that the protocol must be aborted. 

So, we have proved that strict equality holds in 
and thus, from Alice's and Bob's point of view, the 
threshold disturbance for entanglement distillation in the 
context of entanglement-based 2d-state QKD protocols is 



D 



1 



th 



2d 



(35) 



In particular, if the detected average disturbance is be- 
low this threshold, the two legitimate users can be as- 
sured that they share freely entangled qudit-pairs with 
high probability. In other words, under the assumption 
of general coherent attacks, for D < D t h Alice and Bob 
are always able to extract a secret key by application of a 
two-way EPP which purifies towards the maximally en- 
tangled state l^oo)- On the other hand, an estimated 
disturbance above Z?th = (d— l)/2d, does not allow Al- 
ice and Bob to infer whether the state they share is en- 
tangled or not. In particular, we have seen that there 
is at least one simple family of separable states which 
can describe Alice's and Bob's correlations up to high 
error rates of magnitude (2d — l)/2d. Finally, note that 
for d — 2 we reveal the threshold disturbance for the 
standard BB84 QKD protocol, that is Ah = 1/4 0. 
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FIG. 1: (Color online) 2d-state QKD protocols : The thresh- 
old disturbance for entanglement distillation as a function of 
dimension. The triangles refer to Eq. 1351 and arbitrary co- 
herent attacks whereas the circles correspond to Eq. 11361 and 
optimal cloning machines. 



Moreover, Dth — > 1/2 for d — > oo reflecting the possible 
advantage of using higher-dimensional quantum systems 
as information carriers in quantum cryptography. 

In view of the necessary precondition for secret key 
distillation |3q. our results imply that D t h is also the 
ultimate upper security bound of any 2d-state prepare- 
and-measure QKD protocol. Nevertheless, the details 
of a particular prepare-and-measure scheme (that is the 
error correction and privacy amplification protocols re- 
quired) which will be capable of meeting this upper secu- 
rity bound remain an open question. In fact one has to 
specify a classical distillation (post-processing) protocol 
which has the same bounds of tolerable noise as quantum 
distillation protocols. It is worth mentioning, however, 
that the security bound l|35|) relies on certain conditions. 
In particular, it relies on the complete omission of any 
polarization data from the raw key that involve differ- 
ent bases for Alice and Bob, as well as on the individual 
manipulation of each pair during the post-processing. If 
some of these conditions are changed, also the threshold 
disturbance may change. 

Recently, under the same conditions, Acin et al. pl| 
derived another bound for entanglement distillation, 
namely 



D 



(CM) 
th 



1 



1 

V3* 



(36) 



As depicted in Fig. ^ ^th M ' ^ s wen above the thresh- 
old we have derived in this work for any dimension of 
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the information carriers. The reason is basically that 
D[? has been obtained under the additional assump- 
tion that Eve is restricted to so-called "optimal incoher- 
ent attacks" . These attacks rely on cloning machines and 
maximize Eve's information gain. One can easily ver- 
ify, for example, that the class of separable states lf3"3"| 
is not optimal (in the sense of |Hl). In our work we 
allow for arbitrary eavesdropping attacks and thus we 
have demonstrated that the distillation of a secret key 
for disturbances above -D t h is impossible. So, although 
the incoherent attacks considered in [25j are optimal with 
respect to the information gain of an eavesdropper, they 
are not able to disentangle Alice and Bob at the lowest 
possible disturbance. The cost of information loss that 
Eve has to accept by employing an attack that disentan- 
gles Alice and Bob at each particular disturbance above 
D t h remains an open question. Clearly, to this end one 
has to consider in detail the eavesdropping attack and 
this is beyond the purpose of this work. 

A further issue ought to be brought up here in con- 
nection with the existence of bound entanglement. For 
2 ® 2 systems (i.e., for the BB84 QKD protocol) non- 
distillability is equivalent to separability [34[ and this 
fact seems to lead to a complete equivalence between en- 
tanglement distillation and secrecy 35] . However, for 
higher dimensions the situation is more involved due to 
the existence of bound entangled states with positive or 
non-positive partial transpose |33J, l37| . Moreover, in a re- 
cent work [3(| Horedecki et al. showed that a secret key 
can be distilled even from bound entangled states. As a 
consequence, a qudit-based (with d > 2) QKD scheme 
could, in principle, go beyond entanglement distillation. 
However, this does not seem to be the case for the post 
processing and the protocols we consider throughout this 
work. 

Indeed, for D < D t h we have seen that the state shared 
between Alice and Bob is always distillable, i.e. it is 
freely entangled. Bound entangled states are expected 
to exist for D > D t h and this is precisely the regime 
of parameters where the ideas presented in [36j can be 
used for the extraction of a secret key beyond entangle- 
ment distillation. We have demonstrated, however, that 
an eavesdropper is always able to break any entangle- 
ment between Alice and Bob for D > Z? t h without being 
detected, by preparing, for example, a separable state 
from the family gab{D). As a consequence, according 
to |3S|. the protocol must be aborted at D — D t h- Un- 
der these circumstances, the extraction of a secret key 
beyond entanglement distillation seems to be practically 
impossible. The reason is basically that, based on the 
estimated error rate, Alice and Bob are incapable of ver- 
ifying whether they share a separable state or not for dis- 
turbances above D > D t h- Alice and Bob can improve 
their situation only if they do not restrict themselves to 
the sifted data only. In particular, constructing appro- 
priate entanglement witnesses from their raw data |38| . 
Alice and Bob can verify whether they share a separable 
state or not, even for D > D t h- 



Closing this section, let us briefly compare the perfor- 
mance of two different realizations of a six-state QKD 
protocol, namely a 3-bases scheme using qubits and a 
qutrit-bascd scheme using 2 out of 4 mutually unbiased 
bases. In principle, both protocols can tolerate precisely 
the same error rate, that is 1/3. Nevertheless, the qutrit- 
based protocol offers a higher yield since 1/2 of the trans- 
missions pass the sifting procedure (compared to 1 /3 for 
the qubit-based protocol). Thus, although both six-state 
protocols appear to be equally secure, the qutrit based 
scheme seems to be more efficient. 



B. Examples 

So far, our discussion involved arbitrary dimensions 
and general coherent attacks. For the sake of illustration, 
in this subsection we briefly discuss low dimensions (i.e., 
d = 2,3) as well as symmetric (isotropic) channels p4l 
|25| and arbitrary dimensions. In particular, we present 
evidence of the fact that for d — 3 any eavesdropping 
strategy is equivalent to a symmetric one. However, for 
d > 3 this equivalence does not seem to exist anymore. 
Moreover, we present numerical results for d = 3,4 and 
5, verifying the security bounds derived in the previous 
subsection. 



1. Qubits 

As a consequence of Eq. (|23f) . for d — 2 there are three 
different eigenvalues entering Eq. (|21() . So, in a matrix 
form we may write 

A™=(^), 07) 

with the eigenvalues u, x and y satisfying the normal- 
ization condition u + 2x + y = 1. In this notation, 

the estimated disturbance can be expressed in the form 

(j \ 

D = x + y. One can easily verify that the state pig is 
entangled for 1/4 < D and D > 3/4 |45j. Moreover, for 

1/4 < D < 3/4 the state p^g is always separable and 
indistinguishable (as far as the estimated disturbance is 

concerned) from the real state pj^ shared between Alice 
and Bob. 



2. Qutrits 

In analogy to qubits, applying Eq. 123fl for d = 3 
and without any additional assumptions one finds that 
there are three different eigenvalues entering Eq. 121fl . 
In particular, the matrix of eigenvalues reads 

(u x x \ 
x y y J , (38) 
x y y I 
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while the average estimated disturbance is of the form 
D = 2x + Ay. Hence, taking into account the normaliza- 
tion condition u + A(x + y) = 1, we have two real- valued 
and non-negative independent parameters in the prob- 
lcm. Moreover, the partial transpose of p^g is block- 
diagonal with all three blocks being identical and equal 
to 



1 



u + 2x x — y x — y 
M3 = — I x — y x + 2y u — x 
x — y it — x x + 2y 



Hence, the following two eigenvalues 
1 



{-u + 2x + 2y), 
o 

i (u + x + y - V3(x - yfj 



determine the sign of the partial transpose of p^g . Re- 
lated numerical results will be presented below. 



3. Isotropic quantum channels 

For d > 3 the number of independent parameters in 
the problem increases enormously with d, e.g. for d = 4 
we have 



/ £0 m C Vl 

m m m m 

C m £1 % 

m m m m 



(40) 



However, the situation becomes tractable in the case of 
isotropic channels (e.g., open-space QKD) where distur- 
bances involving different errors |46| are equal, thus lead- 
ing to an eigenvalue matrix of the form [22L 124 . \2ty 



/ u x ... x \ 
x y ... y 



\x y 



(41) 



yj 



for any dimension d. 

In the case of qubits, such an isotropy argument does 
not seem to be a restriction. Thus, any eavesdropping 
strategy is equivalent to a symmetric (i.e., isotropic) one 
[47| . This might be due to the fact that such a symmetry 
arises automatically as an inherent property of the qubit- 
based QKD protocols [the matrix 1)3 7|l is of the form J2J]. 
As a consequence, one is always able to substitute any 
eavesdropping attack with a symmetric one which yields 
the same results for all the properties which are defined 
as averages over all the possible messages sent by Alice 
to Bob (e.g., estimated disturbance) |47|. Besides, here 
we see that the symmetry (isotropy) arises automatically 
for qutrits [the matrix 1)38)1 is for the form (|4 1 ft ] and thus 
similar arguments must hold for d — 3 as well. Nev- 
ertheless, we have found that for d > 3 this symmetry 



does not exist [see for instance Eq. i|40|) for d = A] and 
one has to apply it explicitly. Hence, unless the quan- 
tum channel itself is isotropic, a restriction to symmetric 
eavesdropping strategies for d > 3 seems unreasonable 
and might, in general, underestimate Eve's power. How- 
ever, in our case such a restriction does not seem to affect 
the threshold disturbance, while simultaneously enabling 
us to present numerical results regarding 2<i-state QKD 
protocols with d > 3. 

So, using the matrix 1)41 [I. the normalization condition 
J221 reads 

u + 2(d- l)x+(d- l) 2 y = 1, 

and only two of the three parameters (it, x, y) are inde- 
pendent. Moreover, combining Eqs. I)13|l . I|15(l and 1)21(1 
we have that the average estimated disturbance is given 
by 

D=(d- l)x+ (d- ify. 

Finally, in analogy to the case of qutrits, the partial 
transpose of p^g is block-diagonal with each block be- 
ing a d x d matrix. For odd dimensions all the blocks 
arc identical whereas for even dimensions two different 
blocks appear. 



4- Numerical results and discussion 

We have been able to test the results of Sec IV Al nu- 
merically for qutrits, while for higher dimensions we had 
to resort to the assumption of isotropic quantum chan- 
nels, to reduce the number of independent parameters 
in our simulations. More precisely, fixing two indepen- 
dent parameters, say D and x — y, we evaluated all the 
remaining parameters it, x, y which are consistent with 
all the constraints. Subsequently, for the parameters at 
hand we checked whether the distillability condition 128[) 
is fulfilled and whether the two-qudit state p^g has a 
non-positive partial transpose (NPPT). The correspond- 
ing "distillability maps" for d = 3, 4, 5 are presented in 
Figs.0 

Our simulations confirm the validity of 



D 



th 



2d 



as the ultimate robustness bound for 2<i-state QKD pro- 
tocols. More precisely, for D < D t h Alice and Bob share 
always freely entangled qudit pairs [regime (a) in Figs.0. 
On the contrary, for D > Dth we can identify two differ- 
ent regimes of parameters. The dominant regime (b) in- 

volves parameters which yield a p^g with positive partial 
transpose (PPT). These states can not be distilled and 
are either separable or bound entangled |33ll37| . Besides, 

we have the regime of parameters (c), for which (rt^ has a 
NPPT but the reduction criterion is not violated. These 
states probably belong to the hypothetical set of bound 
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FIG. 2: (Color online) 2d-state QKD protocols: The regions 
of the independent parameters D and x — y for which the 
qudit-pair state p^J is (a) NPPT and distillable ; (b) PPT; 
(c) NPPT but the reduction criterion is satisfied. From the 
top to the bottom, the "distillability maps" correspond to 
d = 5, 4 and 3, respectively. The non-negativity of x,yandu 
(straight lines) defines the region of parameters where the pro- 
tocols operate while the distillability condition 12911 separates 
distillable from non-distillable states. The threshold distur- 
bances for entanglement distillation are indicated by black 
dots. The triangles correspond to the separable state 1331 , 
Note the different scales of the horizontal axis. 

entangled states with NPPT j^HH. At this point, it 
could be argued that D > D t h is the regime of parame- 
ters where the ideas of Horodecki et al. might be appli- 
cable for the distillation of a secret key from bound en- 
tangled states 0| . To this end, however, Alice and Bob 
have to confirm whether the state they share is indeed 
bound entangled. Such an identification is only possi- 
ble with the help of appropriate additional entanglement 
witnesses constructed from the polarization data of the 



raw key [13 . 

VI. CONCLUSIONS 

We have discussed the robustness of qudit-based QKD 
protocols that use two mutually unbiased bases, under 
the assumption of general coherent (joint) attacks. For 
d = 3 (i.e., for qutrits), we have presented evidence of 
the fact that any eavesdropping strategy is equivalent to 
a symmetric one, while for higher dimensions this equiv- 
alence is no longer valid. 

The lowest possible disentanglement bound that an 
eavesdropper can saturate in the context of these cryp- 
tographic protocols scales with dimension as (d — l)/2d. 
Whenever Alice and Bob detect disturbances above (d — 
l)/2d, they are not able to infer whether their correla- 
tions originate from an entangled state or not, and the 
protocol must be aborted. On the contrary, if the de- 
tected disturbance is below (d — I)/ 2d, the two honest 
parties can be confident that they share free entangle- 
ment with high probability and the extraction of a secret 
key is, in principle, possible. 

In particular, for the entanglement-based version of 
the protocols such a secure key can be obtained af- 
ter applying an appropriate EPP which purines the qu- 
dit pai rs shared between Alice and Bob towards |\&oo) 
[^Isfjlsills^ l. Moreover, in view of the fundamental role 
of entanglement in secret key distribution [3^|, the de- 
velopment of qudit-based prepare-and-measure schemes 
that can tolerate bit error rates up to (d — l)/2d is also 
possible. For this purpose, however, the construction 
of new appropriate two-way EPPs, which are consistent 
with the associated prepare-and-measure schemes seems 
to be of vital importance. Our results generalize the re- 
sults of [25j to arbitrary coherent attacks and simultane- 
ously answer (to some extent) many of the open issues 
raised in the concluding remarks of that paper. 

Finally, it should be stressed that the disturbance 
thresholds we have obtained depend on the post- 
processing of the QKD protocol. In particular, they rely 
on the complete omission of those qudits of the raw key 
for which Alice and Bob measured in different bases. Fur- 
thermore, they also rely on the fact that Alice and Bob 
manipulate each qudit pair separately. Under these con- 
ditions, we have demonstrated that the extraction of a 
secret-key from bound entangled states is impossible in 
the framework of qudit-based QKD protocols that use 
two mutually unbiased bases. 
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